# NgcIso.exe

Windows Process: Microsoft Corporation

Also called ngciso, ngc isolated, windows hello isolated

Windows, System Component

Windows Hello Isolated NGC. It is the Isolated User Mode trustlet for Next Generation Credentials, not the PIN dialog you type into.

## What you need to know

This isolates Windows Hello secrets. LogonUI.exe still draws the PIN tiles.

NgcIso.exe is the NGC isolation trustlet. It shows up on PCs that use Windows Hello with VBS. Ending it does not hide the lock screen. It weakens the Hello container.

- **Safe?**: Yes, with Windows Hello

  **Is it LogonUI?**: No. This one isolates the credential

  **Should I end it?**: No

Feex says

If NgcIso is running and you use a PIN or face sign-in, I would leave it. The tiles are LogonUI. This process is the vault.

## What is NgcIso.exe?

NgcIso.exe is Isolated NGC, the Windows Hello credential isolation process. NGC is Next Generation Credentials, the PIN and biometric container.

## What does it do?

It holds Hello keys in the isolated world. LogonUI.exe still paints the prompt. winlogon.exe still owns the session.

## Why is it running?

You enrolled a PIN, fingerprint, or face, and the device supports VBS isolation for those keys. A PC that only uses a password may not show it.

## Is it safe?

Usually safe

The Microsoft trustlet is expected with Hello plus VBS. An NgcIso.exe in a zip is not Windows Hello.

A legitimate copy normally runs from:

`C:\Windows\System32\NgcIso.exe`

- Expected publisher: Microsoft Corporation
- IUM trustlet
- UI is LogonUI, not this file

## Can I end it?

No

Ending NgcIso.exe can break PIN and biometric sign-in until reboot. It is not a privacy toggle.

## Can I remove it?

No

Do not delete NgcIso.exe. Remove a Hello PIN from Settings if you want to stop using it.

## Should it start with Windows?

The secure path starts it with Hello. It is not Startup Apps.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: Low except during enroll or unlock

  **Memory**: Small

  **Disk**: Low

  **Network**: None for a local PIN

## File information

| Executable name        | NgcIso.exe                     |
| ---------------------- | ------------------------------ |
| Common legitimate path | C:\Windows\System32\NgcIso.exe |
| Publisher              | Microsoft Corporation          |
| Signature expectation  | Signed by Microsoft Windows    |

## Common problems

### PIN stopped working after an "optimizer" killed isolation

Restore VBS and reboot. Deleting the trustlet is not a PIN reset.

### Confused with LsaIso

LsaIso is Credential Guard for domain hashes. NgcIso is Windows Hello NGC. Two trustlets, two jobs.

## Troubleshooting

Diagnose before you change anything destructive.

### Sign-in options in Settings

Remove and re-add the PIN if Hello is broken. Do not replace NgcIso.exe.

### Check VBS in msinfo32

Hello isolation needs the same foundation as Credential Guard.

## Technical details

Technical details

| Image name | NgcIso.exe                   |
| ---------- | ---------------------------- |
| Role       | Isolated NGC / Windows Hello |

## Related

These entities connect to this article. Type is shown on every link.

[LogonUI.exe: Windows Process](https://feex.it/wiki/process/logonui.exe)[LsaIso.exe: Windows Process](https://feex.it/wiki/process/lsaiso.exe)[winlogon.exe: Windows Process](https://feex.it/wiki/process/winlogon.exe)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: Windows Hello ](https://learn.microsoft.com/windows/security/identity-protection/hello-for-business/)· NGC and Hello
- [Microsoft Learn: IUM processes ](https://learn.microsoft.com/windows/win32/procthread/isolated-user-mode--ium--processes)· Hello isolation uses IUM
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: NgcIso.exe

  **Typical path**: C:\Windows\System32\NgcIso.exe

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/ngciso.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)